OSSA-2026-050: keystonemiddleware access_rules bypass via X-Service-Token¶
- Date:
October 29, 2026
- CVE:
CVE-2026-115642
Affects¶
Keystonemiddleware: <10.9.2, >=10.10.0 <10.12.2, >=11.0.0 <12.0.1, >=13.0.0 <13.0.2
Description¶
Nassim Abbaoui with OVHcloud reported a vulnerability in keystonemiddleware application credential access_rules enforcement. By supplying a custom X-Service-Token header in a request, anyone in posession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges. Deployments that use application credential access_rules, or that enforce token binding, are affected.
Patches¶
https://review.opendev.org/1012874 (2025.1/epoxy)
https://review.opendev.org/1012873 (2025.2/flamingo)
https://review.opendev.org/1012872 (2026.1/gazpacho)
https://review.opendev.org/1012871 (2026.2/hibiscus)
https://review.opendev.org/1012869 (2027.1/indri (development))
Credits¶
Nassim Abbaoui from OVHcloud (CVE-2026-115642)
